New research from Fortra Intelligence and Research Experts (FIRE) dives deeps into an active campaign using fake ChatGPT Plus billing emails, revealing the infrastructure and mechanics keeping it running.
Key findings include:
- Live operators control victim sessions and can escalate from card theft to OTP/2FA capture.
- Identical code and shared identifiers connect independently deployed phishing sites.
- Short-lived sites are replaced while the underlying operation continues.
- The phishing kit is evolving, with newer instances showing changes to its front end.
The analysis shows how a familiar phishing lure has become a repeatable, operator-driven payment-card theft operation.
Full analysis was just published here: https://www.fortra.com/blog/anatomy-openai-phishing-kit-rotating-wordpress-hosts-live-operators-and-otp-theft
Related
This entry was posted on October 26, 2026 at 4:09 pm and is filed under Commentary with tags Fortra. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
New FIRE Analysis: Inside an Active ChatGPT Billing Phishing Campaign
New research from Fortra Intelligence and Research Experts (FIRE) dives deeps into an active campaign using fake ChatGPT Plus billing emails, revealing the infrastructure and mechanics keeping it running.
Key findings include:
The analysis shows how a familiar phishing lure has become a repeatable, operator-driven payment-card theft operation.
Full analysis was just published here: https://www.fortra.com/blog/anatomy-openai-phishing-kit-rotating-wordpress-hosts-live-operators-and-otp-theft
Share this:
Like this:
Related
This entry was posted on October 26, 2026 at 4:09 pm and is filed under Commentary with tags Fortra. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.